NIS2 Risk Management: The Measures Under § 32 NISG 2026 as a Checklist

Since October 1, 2026, essential and important entities must implement appropriate and proportionate technical, operational and organizational risk management measures (§ 32 paras. 1 and 2 NISG 2026). They are based on an all-hazards approach and include at least the ten contents of § 32 para. 4 lit. a to j, which transpose Art. 21(2) of the NIS2 Directive.

• Binding: §§ 31 to 33 NISG 2026 with management duties, minimum contents and evidence.
• Binding: the Annex of Implementing Regulation (EU) 2024/2690 with thirteen points, directly for digital providers such as cloud and managed services, and for all other entities via § 2 NISV 2026.
• Not binding: the ENISA guidance (June 2025) and the FAQ of the Austrian Federal Office for Cybersecurity (BCS).
• Exception: equivalent EU sector-specific law such as DORA displaces § 32 to that extent (§ 27 NISG 2026).

How to read the tables: the “core of the requirement” is binding; where the Annex says “where appropriate, applicable or feasible”, you may deviate only with documented reasons (Art. 2(2) IR).

A management body is whoever is appointed by law, articles of association or contract to manage the business (§ 3 no. 11 NISG 2026); according to the BCS, this means, for example, the managing directors or the executive board, not the IT management or the CISO. The management bodies must ensure and oversee compliance with the risk management measures (§ 31 para. 1), according to the explanatory notes to the government bill including approval of the requirements (cf. Art. 20(1) NIS2 Directive), and must take part in cybersecurity training designed for them (§ 31 para. 2).

• Security policy approved and reviewed annually (IR Annex points 1.1.1(k), 1.1.2).
• Resources committed: staff, funding, processes and technologies (point 1.1.1(e)).
• At least one person is directly accountable to management for security (point 1.2.3).
• Risk assessment and residual risks accepted by management or authorized persons (point 2.1.1).
• Regular reports on the security status and on independent reviews (points 2.2.1, 2.3.3).
• Every member of executive management trained, attendance documented (according to the BCS, employee training is not sufficient); employees are offered training regularly (§ 31 para. 2).
• Management signs audit reports together with the auditors (§ 33 para. 3) and approves the self-declaration (recommendation).

Consequences: The district administrative authority may fine legal entities under § 45, as a priority according to the explanatory notes (§ 44 paras. 3 and 4). Liability under § 9 VStG remains for external representatives, such as managing directors, unless responsible agents are appointed; if the entity is penalized for the same violation, they must not be penalized (§ 44 para. 5). The explanatory notes and BCS state that NISG 2026 provides no separate penalties for management bodies; damages for negligent conduct remain possible. The authority may temporarily prohibit management functions at essential entities (§ 39 para. 4 no. 2).

Proportionality takes into account the entity’s exposure to risks and that of its services, its size, and the likelihood and severity of incidents, including their societal and economic impact (§ 32 para. 3 NISG 2026, Art. 2(2) IR). According to the explanatory notes to the NISV 2026, the Annex is a framework, not a specific implementation description. An example from the BCS: in a micro-enterprise, keeping the inventory and supplier register in a spreadsheet may still be feasible.

The self-declaration provides information on the measures implemented, in particular on the network and information systems used, supply chain security and the results of the risk analysis (§ 33 para. 1). According to the BCS, it will be a form with short, specific questions in the business service portal (USP) and will not replace an audit. Entities that become essential or important later count the twelve months from the date the conditions are met (explanatory notes on § 33). Preparation, recommended by TOMORIS:

• Inventory of services and systems (Annex point 12.4) and register of direct suppliers (point 5.2) up to date.
• Risk analysis with the four categories of § 3 NISV 2026 (technological, human, ICT supply chain, location-related), treatment plan and accepted residual risks.
• Status recorded for each row of checklists 1 to 3, with responsible people and dates; deviations documented with reasons.
• Access to the USP clarified; defined who fills in and who approves; information checked against the evidence.

• Management only informed: approving the policy and the individual training of each member are tasks of the management bodies; residual risks are accepted by management or an authorized person who reports to it (IR Annex points 1.1.1(k), 2.1.1; § 31 para. 2 NISG 2026).
• Outsourcing as relief: according to the BCS, the entity itself remains responsible even if a service provider runs the IT; requirements belong in the contract where appropriate (point 5.1.4).
• Plans never tested: incident response, contingency plan, recovery and crisis management must be tested at planned intervals (points 3.5.5, 4.1.4, 4.2.6, 4.3.4).